Tor over VPN explained, and how to turn it on

What Tor over VPN actually means

There are two layers here, and the order matters. With Tor over VPN your device connects to a ROOT VPN server first, and that server forwards everything on into the Tor network. So the path is: you, then the VPN, then Tor, then the wider internet.

The upshot is that the first Tor relay, the entry node, only ever sees the VPN server's address rather than your home IP. Your internet provider, meanwhile, only sees an ordinary encrypted VPN connection, not the fact that you are using Tor at all. That is the combination most people are after when they reach for this.

Why use it instead of plain Tor

Plain Tor is powerful, but it has rough edges. Your provider can see that you are connecting to the Tor network, some networks block Tor outright, and you normally need the Tor Browser to use it at all. Tor over VPN smooths all three.

Because your traffic reaches Tor from the VPN server, your provider sees only the VPN. Because the VPN carries it, restrictive networks that block Tor directly no longer stand in the way. And because ROOT sets the route up for you, you can reach onion services and the Tor network from any browser or app on the device, no separate Tor Browser required.

What it is good for, and what it is not

Tor over VPN is a strong pick when you want an extra layer of anonymity on top of the VPN, when you need to open a .onion site, or when you are on a network that blocks Tor. It hides your real IP from the Tor network and hides your Tor use from your provider.

It is not a fit for everything. Tor adds several hops, so it is slower than a direct VPN connection and is a poor choice for streaming, gaming or large downloads. For those, use a normal ROOT server. Think of Tor over VPN as a dedicated privacy lane you switch into when you need it, not your everyday connection.